I'm trying to protect a Controller with the @PreAuthorize annotation at type level and try to override that behavior by annotating some methods with a different @PreAuthorize. The Problem is however, that Spring is evaluating the method annotation first (grants access) and is then evaluating the class annotation (denies access).

Is there any way to reverse that order? I couldn't figure it out yet.

Edit:

On the method level, I want to grant access to non-registered Users only:

Annotations may be specified on classes or methods, and method-specific annotations will take precedence.

The concrete implementation of this logic is done in the method findAnnotation of class PrePostAnnotationSecurityMetadataSource. (Unfortunately this method is private.)

So you can write your own MethodSecurityMetadataSource, if you have a look at the code of PrePostAnnotationSecurityMetadataSource, you will see how easy it is.

But one warning at the end: the end: difficult task is not rewriting the method, the difficult task is to "inject" the new MethodSecurityMetadataSource into the security system. I belive you can not do it with the spring security namespace configuration, so you need to replace spring security namespace by explicit bean declaration.

I actually WANT the method level annotation to override the class level annotation. But the method level annotation is evaluated first and class level second so that the class level annotation actually overrides the method's annotation. I Will edit some example into my question.
–
chzbrglaOct 4 '11 at 8:04

Thanks for all your replys.
The answer however, was something totally different :)

I put this here in case anyone else has the same problems.

I registered a custom validator in an @InitBinder annotated method. This binding method is called AFTER the method call requested on the controller. And since this binding method was not annotated with @PreAuthorize, the request was denied.